Nixpkgs security tracker

Try the new UI
Login with GitHub

Published issues

All published security issues are tracked and resolved on GitHub.

NIXPKGS-2026-0396
published 6 months, 4 weeks ago
Permalink CVE-2026-25138
5.3 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): Low (L)
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): Low (L)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has Username Enumeration via Login Error Message

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-38wq-6q2w-hcf9
NIXPKGS-2026-0397
published 6 months, 4 weeks ago
Permalink CVE-2026-25733
7.3 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-rwj9-7j48-9f7q
NIXPKGS-2026-0398
published 6 months, 4 weeks ago
Permalink CVE-2026-25136
8.1 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-h79m-5jjm-jm4q
NIXPKGS-2026-0432
published 6 months, 4 weeks ago
Permalink CVE-2026-28218
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    5 packages
    • discourse-mail-receiver
    • python312Packages.pydiscourse
    • python313Packages.pydiscourse
    • python314Packages.pydiscourse
    • grafanaPlugins.grafana-discourse-datasource
    6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution

discourse
  • ==>= 2026.1.0-latest, < 2026.1.1
  • ==< 2025.12.2
  • ==>= 2026.2.0-latest, < 2026.2.0 
Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5
NIXPKGS-2026-0464
published 6 months, 4 weeks ago
Permalink CVE-2026-25985
7.5 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): High (H)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    3 packages
    • tests.pkg-config.defaultPkgConfigPackages.ImageMagick
    • tests.pkg-config.defaultPkgConfigPackages.MagickWand
    • graphicsmagick-imagemagick-compat
    6 months, 4 weeks ago
  • @LeSuisse deleted
    3 maintainers
    • @faukah
    • @rhendric
    • @dotlambda
    6 months, 4 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Memory allocation with excessive without limits in the internal SVG decoder

ImageMagick
  • ==>= 7.0.0, < 7.1.2-15
  • ==< 6.9.13-40
NIXPKGS-2026-0399
published 6 months, 4 weeks ago
Permalink CVE-2026-25734
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has Stored Cross-site Scripting (XSS) in RSE Metadata

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-h9fp-p2p9-873q
NIXPKGS-2026-0400
published 6 months, 4 weeks ago
Permalink CVE-2026-25736
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-fq4f-4738-rqxm
NIXPKGS-2026-0444
published 6 months, 4 weeks ago
Permalink CVE-2026-27468
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored
    11 packages
    • mastodon-bot
    • bitlbee-mastodon
    • mastodon-archive
    • nodePackages.mastodon-bot
    • python312Packages.mastodon-py
    • python313Packages.mastodon-py
    • python314Packages.mastodon-py
    • nodePackages_latest.mastodon-bot
    • home-assistant-component-tests.mastodon
    • tests.home-assistant-component-tests.mastodon
    • wordpressPackages.plugins.simple-mastodon-verification
    6 months, 4 weeks ago
  • @LeSuisse deleted
    4 maintainers
    • @Izorkin
    • @ghuntley
    • @happy-river
    • @erictapen
    6 months, 4 weeks ago maintainer.delete
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Mastodon may allow unconfirmed FASP to make subscriptions

mastodon
  • ==>= 4.4.0, < 4.4.14
  • ==>= 4.5.0, < 4.5.7 
Upstream advisory: https://github.com/mastodon/mastodon/security/advisories/GHSA-qgmm-vr4c-ggjg
NIXPKGS-2026-0401
published 6 months, 4 weeks ago
Permalink CVE-2026-25735
6.1 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

Rucio WebUI has a Stored Cross-site Scripting (XSS) vulnerability its Identity Name

rucio
  • ==>= 39.0.0rc1, < 39.3.1
  • ==>= 36.0.0rc1, < 38.5.4
  • ==< 35.8.3 
Upstream advisory: https://github.com/rucio/rucio/security/advisories/GHSA-8wpv-6x3f-3rm5
NIXPKGS-2026-0402
published 6 months, 4 weeks ago
Permalink CVE-2026-2903
3.3 LOW
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): None (N)
  • Availability (A): Low (L)
  • Exploit Code Maturity (E): Proof-of-Concept (P)
  • Remediation Level (RL): Official Fix (O)
  • Report Confidence (RC): Confirmed (C)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): None (N)
  • Modified Availability (MA): Low (L)
updated 6 months, 4 weeks ago by @LeSuisse Activity log
  • Created suggestion 6 months, 4 weeks ago
  • @LeSuisse ignored package vimPlugins.nvim-treesitter-parsers.re2c 6 months, 4 weeks ago
  • @LeSuisse accepted 6 months, 4 weeks ago
  • @LeSuisse published on GitHub 6 months, 4 weeks ago

skvadrik re2c ast.cc check_and_merge_special_rules null pointer dereference

re2c
  • ==4.2
  • ==4.0
  • ==4.1
  • ==4.4
  • ==4.3 
Upstream issue: https://github.com/skvadrik/re2c/issues/571
Upstream patch: https://github.com/skvadrik/re2c/commit/febeb977936f9519a25d9fbd10ff8256358cdb97